How to edit sandbox profiles?

Question

Level 4

1,491 points

How to edit sandbox profiles?

Has anyone had any experience of modifying system sandbox profiles? (Yes, I want to reduce the security of my system! )

Essentially, I want to add (allow file-write*) to com.apple.security.print.

I could just modify the applications.sb file in /Systems/Library/Sandbox/Profiles, but I'd prefer to create a separate file in /Library/Sandbox/Profiles, because amending files in /System is a Bad Thing, obviously, and also because I want the change to survive updates.

Why do I want to do this? Because I have a CUPS backend that acts as a Virtual Printer, saving files to disks. Currently, sandboxing prevents the files from being saved in the user domain. The only places the files can be saved is in /var or /tmp, and I need a permanent location that is also included in Spotlight's indexing. Keeping all files inside the user domain is also nice and tidy.

Posted on Jun 22, 2014 5:56 AM

Reply

Answer 1

etresoft

Level 9

57,242 points

Jun 22, 2014 6:38 PM in response to benwiggy

Since CUPS is shipped with the OS, modifying files in /Library might not help. Most people, including the developers of CUPS-PDF, find it easier to just write to a location with shared write access. See this thread: CUPS-PDF Produces no output?

Reply

Answer 2

benwiggy Author

Level 4

1,491 points

Jun 22, 2014 10:59 PM in response to etresoft

Thanks for the reply. That's a very old thread. CUPS-PDF is similarly bound by the Sandboxing, and since Snow Leopard can only write into /tmp and /var.

I was assuming that by adding a Sandbox profile to /Library, that would modify the data already in /System. I could be wrong. For the moment, I'm editing the /System sandbox profile directly. I'm not getting a sandboxd deny file-write log message, though it's still not working, and instead I get a log message about Sandbox cache error 3850.

Reply